= Guide to Integrating Forensic Techniques into Incident Response by Karen Kent and others
{c}
{tag=Work by Karen Kent}
https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-86.pdf
NIST SP800-86, August2006, DOI10.6028/NIST.SP.800-86; first author Karen Kent verified on official record https://csrc.nist.gov/pubs/sp/800/86/final . Section2.1, printedp.2-2, and section3 describe collection, examination, analysis and reporting; section3.1 addresses data integrity and section3.3 interpretation/correlation. Primary institutional guide concerns incident response and troubleshooting, not only criminal proceedings. Clock-offset example is independently stipulated, not an incident reconstructed from the guide.
https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-86.pdf[§3.1.2, printedp.3-4, verifying acquired-data integrity by comparing original and copied message digests]
Back to article page
